fad-checker

fad-checker AKA F ormidable A uditor's D ependency C hecker AKA F uckin' A utonomous D ependency C hecker fad-checker is a polyglot dependency auditor built for professional code audits. It scans 10 ecosystems + 9 CMS/Frameworks WordPress, Drupal, Symfony, Laravel… in one pass, with no build tool...

Sunhillo SureLine <8.7.0.1.1 - Unauthenticated OS Command Injection

Sunhillo SureLine 8.7.0.1.1 is vulnerable to OS command injection. The /cgi/networkDiag.cgi script directly incorporated user-controllable parameters within a shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. The following POST request...

F5 BIG-IP - Unauthenticated RCE via AJP Smuggling

CVE-2023-46747 is a critical severity authentication bypass vulnerability in F5 BIG-IP that could allow an unauthenticated attacker to achieve remote code execution RCE. The vulnerability impacts the BIG-IP Configuration utility, also known as the TMUI, wherein arbitrary requests can bypass...

Spring Cloud - Remote Code Execution

Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions are susceptible to remote code execution vulnerabilities. When using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and...

Apache Struts 2.0.0-2.5.25 - Remote Code Execution

Apache Struts 2.0.0 through Struts 2.5.25 is susceptible to remote code execution because forced OGNL evaluation, when evaluated on raw user input in tag attributes, may allow it. id: CVE-2020-17530 info: name: Apache Struts 2.0.0-2.5.25 - Remote Code Execution author: pikpikcu severity: critical...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-96951link is external Microsoft Windows Command Injection Vulnerability CVE-2026-104935link is external Ivanti Connect Secure Authentication Bypass by...

CrushFTP VFS - Sandbox Escape LFR

VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox. id: CVE-2024-4040 info: name: CrushFTP VFS - Sandbox Escape LFR author: DhiyaneshDK,pussycat0x severity:...

CVE-2025-62215_analysis

CVE-2025-62215 Vulnerability Analysis Windows Kernel Race Condition / Double-Free Privilege Escalation の脆弱性調査プロジェクト。 Overview Item| Detail ---|--- CVE| CVE-2025-62215 Component| Windows Kernel ntoskrnl.exe Type| Race Condition CWE-362 / Double Free CWE-415 Impact| Local Privilege Escalation →...

Microsoft SharePoint Server - Remote Code Execution (ToolShell)

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. This vulnerability is part of the ToolShell exploit chain and when combined with CVE-2025-53771 authentication bypass, enables unauthenticated remote code...

rxerium-templates

Una raccolta curata di 144+ template Nuclei incentrati su vulnerabilità zero-day e attivamente sfruttate in natura , con alcuni template miscellanei. I template utilizzano tecniche di rilevamento passive corrispondenza versione/data e sono organizzati per anno per una facile navigazione. ⚠️ Nota:...

Airflow Experimental <1.10.11 - REST API Auth Bypass

Airflow's Experimental API prior 1.10.11 allows all API requests without authentication. id: CVE-2020-13927 info: name: Airflow Experimental 1.10.11 - REST API Auth Bypass author: pdteam severity: critical description: | Airflow's Experimental API prior 1.10.11 allows all API requests without...

Ch4120N-CVE-Pulse

⚡ Ch4120N CVE Pulse Live CVE PoC Aggregator with Smart Search & Threat Intelligence CVE Pulse automatically discovers, scores, and indexes CVE Proof‑of‑Concepts from GitHub. It enriches them with EPSS scores and CISA KEV data, builds daily snapshots & diffs, and serves a fast, searchable static...

Micro Focus Operations Bridge Reporter - Remote Code Execution

Micro Focus Operations Bridge Reporter 10.40 is susceptible to remote code execution. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. id: CVE-2021-22502 info: name: Micro Focus...

XStream 1.4.18 - Remote Code Execution

XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

TeamCity < 2023.11.4 - Authentication Bypass

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible id: CVE-2024-27198 info: name: TeamCity 2023.11.4 - Authentication Bypass author: DhiyaneshDk severity: critical description: | In JetBrains TeamCity before 2023.11.4 authentication bypass...

Zoho ManageEngine - Remote Code Execution

Zoho ManageEngine Password Manager Pro, PAM 360, and Access Manager Plus are susceptible to unauthenticated remote code execution via XML-RPC. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

Ruckus Wireless Admin - Remote Code Execution

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request. id: CVE-2023-25717 info: name: Ruckus Wireless Admin - Remote Code Execution author: parthmalhotra,pdresearch severity: critical description: | Ruckus Wireless Admin through 10.4 allows Remote...

cve-threat-intelligence-hub

cve · threat-intelligence · vulnerabilities · cisa-kev · epss ·...

Adobe ColdFusion - Deserialization of Untrusted Data

Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-38203 info: name:...

PAN-OS Management Web Interface - Authentication Bypass

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege...